From a442feda216301bce1debbd4a1a7580e800e74f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Louis=20Pr=C3=A9?= <louis@getseam.com>
Date: Mon, 5 Oct 2026 14:45:57 -0700
Subject: [PATCH] ci: Publish to npm with trusted publishing

The NPM_TOKEN secret no longer works, so the v0.8.0 npm publish failed with
E404. dbtypr is already configured as an npm trusted publisher for
publish.yml, so publish via OIDC instead, matching other seamapi repos:
npm-publish@v4, id-token: write, Node 24 (npm >= 11.5.1), no token.

Also add a workflow_dispatch trigger that builds an existing tag and
publishes it to npm only, to publish v0.8.0 after this merges.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/_build.yml   |  7 +++++++
 .github/workflows/_publish.yml |  5 +++--
 .github/workflows/publish.yml  | 16 +++++++++++++---
 3 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/_build.yml b/.github/workflows/_build.yml
index 6d9a099..5375ec4 100644
--- a/.github/workflows/_build.yml
+++ b/.github/workflows/_build.yml
@@ -9,6 +9,11 @@ on:
         type: string
         required: false
         default: '20'
+      ref:
+        description: The git ref to build (defaults to the triggering ref).
+        type: string
+        required: false
+        default: ''
     outputs:
       artifact_name:
         description: The artifact name.
@@ -22,6 +27,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
       - name: Setup
         uses: ./.github/actions/setup
         with:
diff --git a/.github/workflows/_publish.yml b/.github/workflows/_publish.yml
index 3b8a6af..84e24b6 100644
--- a/.github/workflows/_publish.yml
+++ b/.github/workflows/_publish.yml
@@ -15,7 +15,7 @@ on:
     secrets:
       registry_token:
         description: The package registry token.
-        required: true
+        required: false
 
 jobs:
   publish:
@@ -28,6 +28,7 @@ jobs:
       - name: Setup
         uses: ./.github/actions/setup
         with:
+          node_version: '24'
           install_dependencies: 'false'
       - name: Download artifact
         uses: actions/download-artifact@v4
@@ -38,7 +39,7 @@ jobs:
         id: meta
         run: echo "tgz=$(ls *.tgz | head -n1)" >> $GITHUB_OUTPUT
       - name: Publish
-        uses: JS-DevTools/npm-publish@v3
+        uses: JS-DevTools/npm-publish@v4
         with:
           access: public
           token: ${{ secrets.registry_token }}
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 79f91c0..bf7fb0d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,19 +1,27 @@
 ---
 name: Publish
 
-run-name: Publish ${{ github.ref_name }}
+run-name: Publish ${{ inputs.tag || github.ref_name }}
 
 on:
   push:
     tags:
       - v*
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing version tag to publish to npm (e.g. v1.2.3)
+        required: true
 
 jobs:
   build:
     name: Build
     uses: ./.github/workflows/_build.yml
+    with:
+      ref: ${{ inputs.tag }}
   release:
     name: GitHub Releases
+    if: github.event_name == 'push'
     runs-on: ubuntu-latest
     timeout-minutes: 30
     needs: build
@@ -47,13 +55,15 @@ jobs:
     name: npm
     uses: ./.github/workflows/_publish.yml
     needs: build
+    permissions:
+      contents: read
+      id-token: write
     with:
       artifact_name: ${{ needs.build.outputs.artifact_name }}
       registry_url: https://registry.npmjs.org
-    secrets:
-      registry_token: ${{ secrets.NPM_TOKEN }}
   github:
     name: GitHub Packages
+    if: github.event_name == 'push'
     uses: ./.github/workflows/_publish.yml
     permissions:
       contents: read